Merge branch 'bpf-memory-safety-lifetime-and-locking-fixes'

Alexei Starovoitov says:

====================
bpf: Memory safety, lifetime and locking fixes

This series collects fixes for bugs in the BPF core, the verifier and the
BPF side of the networking stack. Most of them are from Josef.

Every bug was reproduced in a VM on top of bpf-next, on the kernel right
before and right after the patch that fixes it. The splats are in the
commit logs. That goes for what the reviews of v1 have found as well.

Sleeping, or doing without RCU, where that is not allowed:
  02 hash map for_each callbacks of sleepable programs
  05 sleepable programs on the task_vma iterator
  06 bpf_find_vma() callbacks of sleepable programs
  24 maps that rely on RCU in bpf_wq and bpf_task_work callbacks

Buffers that iterators and writable tracepoints hand to programs:
  19 BPF_LINK_UPDATE skips the size check of the attach
  25 tail calls from an iterator program
  26 extensions of an iterator program
  27 tail calls from a writable raw tracepoint program
  28 extensions of a writable raw tracepoint program
  29 writes over bpf_timer, bpf_spin_lock, kptr in a live map value

The sk_storage map iterator:
  14 a socket that sk_clone() is still building can be found and used
  15 NULL dereference if the socket goes away
  16 an element of a storage that was never published can be found
  17 the socket is not held while the program runs

Lifetime of local storage, programs and maps:
  10 owner_refcnt saturates on the last unpin
  30 map_free() frees elements under sleepable readers
  22 a program is freed under its bpf_wq callback
  23 an inner map is freed under a sleepable callback

XDP and devices:
  01 devmap egress programs free page_pool fragments as plain pages
  20 stale offload->prog after bpf_prog_realloc()
  21 a program is bound to a netdev that is being unregistered

seg6local End.BPF and bpf_skb_adjust_room():
  11 the SRH of the inner packet is not validated after End.DT6
  12 the inner header is not pulled for End.DT6
  13 stale SRH pointer if End.B6 fails late
  08 gso_size can drop to 0 or wrap around

The rest:
  03 inode leak if BPF_TOKEN_CREATE fails
  04 preallocated hash map hands out an element that is still linked
  07 BPF_JSET with a 64 bit mask, 32-bit kernels only
  09 probe names of a perf event are read without event_mutex
  18 unbounded recursion in the BTF show code

Some of the fixes make the kernel refuse what it has accepted so far:

 - 02, 06: helpers, kfuncs and global functions that may sleep are rejected
   in these callbacks.
 - 05: sleepable programs cannot be attached to the task_vma iterator.
 - 24: in sleepable callbacks, and for inner maps in sleepable programs,
   maps that rely on RCU need bpf_rcu_read_lock().
 - 25, 27: a program with a tail call cannot be attached to a map element
   iterator or to a writable tracepoint.
 - 29: an iterator program that writes over a special field cannot be
   attached to that map.
 - 04: a nested update of a preallocated hash map on the same CPU can fail
   with -EBUSY.
 - 08: bpf_skb_adjust_room() returns -ENOTSUPP if gso_size would drop below
   TCP_MIN_GSO_SIZE.
 - 28: writable raw tracepoint programs cannot be extended.

With all 43 patches of the series applied, test_progs in its three
flavors, test_maps and test_verifier show no new failures.
cpumask/test_insert_leave is flaky when the tests run in parallel, with
and without the series: its program does not check is_test_task(), so any
other fork in the system makes it fail.

veristat sees no difference for the 5689 programs of the selftests, nor for
the 466 programs of the sched_ext schedulers that BPF CI builds: same
verdicts, insns, states and stack depth.

v1 -> v2, all of it after the reviews by sashiko and the BPF CI bot:
 - rebased
 - 04: cancel the special fields before the element goes into the slot
 - 08: leave at least TCP_MIN_GSO_SIZE
 - 16: new. The check in 17 did not hold for a storage that lost the race
   in bpf_local_storage_alloc().
 - 20: update offload->prog under bpf_devs_lock, in
   bpf_jit_prog_release_other() as well
 - 24: a global function that is called with preemption or interrupts
   disabled got around the check
 - 28: new. Extensions got around 27.
 - 18: no change. bpf_snprintf_btf() and bpf_seq_printf_btf() only take
   vmlinux BTF, and the map read in bpffs is BTF_SHOW_UNSAFE.

v1: https://lore.kernel.org/bpf/20261017012058.355787-1-alexei.starovoitov@gmail.com/
====================

Patches 1-30 are applied. The other 13 need one more revision.

Link: https://patch.msgid.link/20261017163745.3341787-1-alexei.starovoitov@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

0 files changed, 0 insertions, 0 deletions